configure: Add an option to build with AddressSanitizer

diff --git a/.lsan.suppressions b/.lsan.suppressions
new file mode 100644 (file)
index 0000000..be166e5
--- /dev/null
+++ b/.lsan.suppressions
@@ -0,0 +1,7 @@
+leak:EVP_CIPHER_fetch
+leak:EVP_KEYEXCH_fetch
+leak:EVP_KEYMGMT_fetch
+leak:EVP_RAND_fetch
+leak:OSSL_DECODER_do_all_provided
+leak:OSSL_ENCODER_do_all_provided
+leak:OSSL_PROVIDER_load

diff --git a/configure.ac b/configure.ac
index b152456ba0d34422ef058c85bb8497b2a27a7f7d..dcb92da92229eb34a9e68a89e67a765efd533c63 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2007-2017 Tobias Brunner
+# Copyright (C) 2007-2022 Tobias Brunner
 # Copyright (C) 2006-2022 Andreas Steffen
 # Copyright (C) 2006-2014 Martin Willi
 #
@@ -327,6 +327,7 @@ ARG_ENABL_SET([tss-trousers],   [enable the use of the TrouSerS Trusted Software
 ARG_ENABL_SET([tss-tss2],       [enable the use of the TSS 2.0 Trusted Software Stack])
 
 # compile options
+ARG_ENABL_SET([asan],           [enable build with AddressSanitizer (ASan).])
 ARG_ENABL_SET([coverage],       [enable lcov coverage report generation.])
 ARG_ENABL_SET([git-version],    [use output of 'git describe' as version information in executables.])
 ARG_ENABL_SET([leak-detective], [enable malloc hooks to find memory leaks.])
@@ -1378,6 +1379,27 @@ if test x$fuzzing = xtrue; then
        esac
 fi
 
+if test x$asan = xtrue; then
+       # adding this here and not earlier or passed to the script avoids issues
+       # e.g. with libpthread (libasan provides stubs for its functions but no full
+       # implementation so configure does not detect that -lpthread is required
+       # when GCC is used, clang always adds -lpthread)
+       CFLAGS="$CFLAGS -fsanitize=address -fno-omit-frame-pointer"
+       # this is necessary so AddressSanitizer can resolve symbols e.g. for
+       # C++ exceptions that are used in libbotan
+       if test x$botan = xtrue; then
+               LDFLAGS="$LDFLAGS -lstdc++"
+       fi
+       if test x$openssl = xtrue; then
+               # we need to suppress some leaks with OpenSSL 3 as we don't deinitialze
+               # it properly
+               AC_SUBST(LSAN_OPTIONS, [suppressions=\${abs_top_srcdir}/.lsan.suppressions])
+               # use this instead of AM_TESTS_ENVIRONMENT as we don't use the parallel
+               # test harness
+               AC_SUBST(TESTS_ENVIRONMENT, ['export LSAN_OPTIONS="$(LSAN_OPTIONS)";'])
+       fi
+fi
+
 if test x$ruby_gems = xtrue; then
        AC_PATH_PROG([GEM], [gem], [], [$PATH:/bin:/usr/bin:/usr/local/bin])
        if test x$GEM = x; then

diff --git a/src/libcharon/plugins/vici/python/Makefile.am b/src/libcharon/plugins/vici/python/Makefile.am
index a2e7596e48fbaf8a3412a5282a9b39d70332d5cf..aa036c96c922c4bc1bf4387b7af62b166fbb85a5 100644 (file)
--- a/src/libcharon/plugins/vici/python/Makefile.am
+++ b/src/libcharon/plugins/vici/python/Makefile.am
@@ -40,7 +40,7 @@ install-exec-local: dist/vici-$(PYTHON_PACKAGE_VERSION)-py$(PYTHON_VERSION).egg
 endif
 
 if USE_TOX
-  TESTS_ENVIRONMENT = export TOX=$(TOX);
+  TESTS_ENVIRONMENT += export TOX=$(TOX);
   AM_TESTS_FD_REDIRECT = 1>&2
   TESTS = tox.sh
 endif